Distributed Authentication with Data Cloud

• US 20130019299A1
• Filed: 12/21/2010
• Published: 01/17/2013
• Est. Priority Date: 12/29/2009
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Lumme, Tapani, Vepslinen, Ari, Mki, Jussi
• Granted Patent: US 9,485,246 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A method includes, in response to a need to access for a user certain stored data that requires authentication, sending a request for the stored data into a data cloud, the request not identifying the user. The method further includes receiving, from the data cloud, response information descriptive of an authentication realm and a single-use nonce; presenting the information descriptive of the authentication realm to the user and prompting the user for a user name and password; re-sending the request into the data cloud with an authentication header having user credentials generated at least in part using the response information, the user credentials comprising the user name and a hashed password; and if the user credentials are valid, receiving from the data cloud the requested stored data.

Claims

1. A method, comprising:

in response to a need to access for a user certain stored data that requires authentication, sending a request for the stored data into a data cloud, the request not identifying the user;

receiving, from the data cloud, response information descriptive of an authentication realm;

presenting the information descriptive of the authentication realm to the user and prompting the user for a user name and password; and

re-sending the request into the data cloud with an authentication header having user credentials generated at least in part using the response information, the user credentials comprising the user name and a hashed password;

2. The method of claim 1, where the user credentials are stored in the data cloud.

3. The method of claim 1, where authorization to the user credentials is based on an open authorization key and secret.

4. The method of claim 1, where authorization to the user credentials is based on at least one of a secure sockets layer or transparent layer security.

5. The method of claim 1, where the user credentials are stored in the data cloud as a <

key, value>

pair, where the key is comprises a combination of user name and hashed password.

6. The method of claim 5, where the value comprises information descriptive of how many times the data has been accessed during some interval of time.

7. The method of claim 1, where user name in the user credentials is also hashed.

8. The method of claim 1, where the user credentials are valid only if they match user credentials already stored in the data cloud.

9. The method of claim 8, where in response to the user credentials being valid, further comprising generating a cookie, and storing the cookie into the data cloud.

10. The method of claim 9, where the cookie is available only for a single user browsing session.

11. The method of claim 10, where the cookie is comprised of a single sign on token.

12. The method of claim 1, performed as a result of execution of computer program instructions stored in a computer-readable storage medium.

13. An apparatus, comprising:

a processor; and

a memory including computer program code, where the memory and computer program code are configured to, with the processor, cause the apparatus at least to perform, in response to a need to access for a user certain stored data that requires authentication, sending a request for the stored data into a data cloud, the request not identifying the user;

receiving, from the data cloud, response information descriptive of an authentication realm;

presenting the information descriptive of the authentication realm to the user and prompting the user for a user name and password; and

re-sending the request into the data cloud with an authentication header having user credentials generated at least in part using the response information, the user credentials comprising the user name and a hashed password.

14. The apparatus of claim 13, where the user credentials are stored in the data cloud.

15. The apparatus of claim 13, where authorization to the user credentials is based on an open authorization key and secret.

16. The apparatus of claim 13, where authorization to the user credentials is based on at least one of a secure sockets layer or transparent layer security.

17. The apparatus of claim 13, where the user credentials are stored in the data cloud as a <

key, value>

pair, where the key is comprises a combination of user name and hashed password.

18. The apparatus of claim 17, where the value comprises information descriptive of how many times the data has been accessed during some interval of time.

19. The apparatus of claim 13, where user name in the user credentials is also hashed.

20. The apparatus of claim 13, where the user credentials are valid only if they match user credentials already stored in the data cloud.

21. The apparatus of claim 20, where in response to the user credentials being valid, further comprising generating a cookie, and storing the cookie into the data cloud.

22. The apparatus of claim 21, where the cookie is available only for a single user browsing session.

23. The apparatus of claim 22, where the cookie is comprised of a single sign on token.